{"push_id":1943195358,"size":11,"distinct_size":11,"ref":"refs/heads/linux-3.18.y","head":"25efe5c96eb6454d87127afb3affe3c874e1d45e","before":"a82d5fd0c3a5f303b0e5f8fca834a1cce0655070","commits":[{"sha":"5776984fafdc8b18fb6ddd8264e6cc274b8ef349","author":{"name":"Liping Zhang","email":"5172c2e8f5e3c16ed9d51bfc012aefe573d818e4@gmail.com"},"message":"netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister\n\ncommit 9c3f3794926a997b1cab6c42480ff300efa2d162 upstream.\n\nIf one cpu is doing nf_ct_extend_unregister while another cpu is doing\n__nf_ct_ext_add_length, then we may hit BUG_ON(t == NULL). Moreover,\nthere's no synchronize_rcu invocation after set nf_ct_ext_types[id] to\nNULL, so it's possible that we may access invalid pointer.\n\nBut actually, most of the ct extends are built-in, so the problem listed\nabove will not happen. However, there are two exceptions: NF_CT_EXT_NAT\nand NF_CT_EXT_SYNPROXY.\n\nFor _EXT_NAT, the panic will not happen, since adding the nat extend and\nunregistering the nat extend are located in the same file(nf_nat_core.c),\nthis means that after the nat module is removed, we cannot add the nat\nextend too.\n\nFor _EXT_SYNPROXY, synproxy extend may be added by init_conntrack, while\nsynproxy extend unregister will be done by synproxy_core_exit. So after\nnf_synproxy_core.ko is removed, we may still try to add the synproxy\nextend, then kernel panic may happen.\n\nI know it's very hard to reproduce this issue, but I can play a tricky\ngame to make it happen very easily :)\n\nStep 1. Enable SYNPROXY for tcp dport 1234 at FORWARD hook:\n  # iptables -I FORWARD -p tcp --dport 1234 -j SYNPROXY\nStep 2. Queue the syn packet to the userspace at raw table OUTPUT hook.\n        Also note, in the userspace we only add a 20s' delay, then\n        reinject the syn packet to the kernel:\n  # iptables -t raw -I OUTPUT -p tcp --syn -j NFQUEUE --queue-num 1\nStep 3. Using \"nc 2.2.2.2 1234\" to connect the server.\nStep 4. Now remove the nf_synproxy_core.ko quickly:\n  # iptables -F FORWARD\n  # rmmod ipt_SYNPROXY\n  # rmmod nf_synproxy_core\nStep 5. After 20s' delay, the syn packet is reinjected to the kernel.\n\nNow you will see the panic like this:\n  kernel BUG at net/netfilter/nf_conntrack_extend.c:91!\n  Call Trace:\n   ? __nf_ct_ext_add_length+0x53/0x3c0 [nf_conntrack]\n   init_conntrack+0x12b/0x600 [nf_conntrack]\n   nf_conntrack_in+0x4cc/0x580 [nf_conntrack]\n   ipv4_conntrack_local+0x48/0x50 [nf_conntrack_ipv4]\n   nf_reinject+0x104/0x270\n   nfqnl_recv_verdict+0x3e1/0x5f9 [nfnetlink_queue]\n   ? nfqnl_recv_verdict+0x5/0x5f9 [nfnetlink_queue]\n   ? nla_parse+0xa0/0x100\n   nfnetlink_rcv_msg+0x175/0x6a9 [nfnetlink]\n   [...]\n\nOne possible solution is to make NF_CT_EXT_SYNPROXY extend built-in, i.e.\nintroduce nf_conntrack_synproxy.c and only do ct extend register and\nunregister in it, similar to nf_conntrack_timeout.c.\n\nBut having such a obscure restriction of nf_ct_extend_unregister is not a\ngood idea, so we should invoke synchronize_rcu after set nf_ct_ext_types\nto NULL, and check the NULL pointer when do __nf_ct_ext_add_length. Then\nit will be easier if we add new ct extend in the future.\n\nLast, we use kfree_rcu to free nf_ct_ext, so rcu_barrier() is unnecessary\nanymore, remove it too.\n\nSigned-off-by: Liping Zhang <zlpnobody@gmail.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: Stefan Bader <stefan.bader@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/5776984fafdc8b18fb6ddd8264e6cc274b8ef349"},{"sha":"dc7a0acd79f45adfb48bef68a17c7ab0744a0b0f","author":{"name":"Jan Kara","email":"7bb7087018cc5fef3c041f6f038f586664845dbf@suse.cz"},"message":"audit: Fix use after free in audit_remove_watch_rule()\n\ncommit d76036ab47eafa6ce52b69482e91ca3ba337d6d6 upstream.\n\naudit_remove_watch_rule() drops watch's reference to parent but then\ncontinues to work with it. That is not safe as parent can get freed once\nwe drop our reference. The following is a trivial reproducer:\n\nmount -o loop image /mnt\ntouch /mnt/file\nauditctl -w /mnt/file -p wax\numount /mnt\nauditctl -D\n<crash in fsnotify_destroy_mark()>\n\nGrab our own reference in audit_remove_watch_rule() earlier to make sure\nmark does not get freed under us.\n\nReported-by: Tony Jones <tonyj@suse.de>\nSigned-off-by: Jan Kara <jack@suse.cz>\nTested-by: Tony Jones <tonyj@suse.de>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/dc7a0acd79f45adfb48bef68a17c7ab0744a0b0f"},{"sha":"014e673b0c563f497e0e71cfd65b7c75ad738732","author":{"name":"Thomas Bogendoerfer","email":"67f449bd4ae477b86d76e89b596f6543bd68f1e6@alpha.franken.de"},"message":"parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo\n\ncommit 4098116039911e8870d84c975e2ec22dab65a909 upstream.\n\nFor 64bit kernels the lmmio_space_offset of the host bridge window\nisn't set correctly on systems with dino/cujo PCI host bridges.\nThis leads to not assigned memory bars and failing drivers, which\nneed to use these bars.\n\nSigned-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>\nAcked-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/014e673b0c563f497e0e71cfd65b7c75ad738732"},{"sha":"f1bfa63f2e683a0d18c8508694d5aff81afe8298","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Apply sample rate quirk to Sennheiser headset\n\ncommit a8e800fe0f68bc28ce309914f47e432742b865ed upstream.\n\nA Senheisser headset requires the typical sample-rate quirk for\navoiding spurious errors from inquiring the current sample rate like:\n usb 1-1: 2:1: cannot get freq at ep 0x4\n usb 1-1: 3:1: cannot get freq at ep 0x83\n\nThe USB ID 1395:740a has to be added to the entries in\nsnd_usb_get_sample_rate_quirk().\n\nBugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1052580\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/f1bfa63f2e683a0d18c8508694d5aff81afe8298"},{"sha":"d5a76b2ba6871a875fdcd598548176ce3464aa30","author":{"name":"zhong jiang","email":"7423c4e5f86c275f385559b3da3d3b3ed295b704@huawei.com"},"message":"mm/mempolicy: fix use after free when calling get_mempolicy\n\ncommit 73223e4e2e3867ebf033a5a8eb2e5df0158ccc99 upstream.\n\nI hit a use after free issue when executing trinity and repoduced it\nwith KASAN enabled.  The related call trace is as follows.\n\n  BUG: KASan: use after free in SyS_get_mempolicy+0x3c8/0x960 at addr ffff8801f582d766\n  Read of size 2 by task syz-executor1/798\n\n  INFO: Allocated in mpol_new.part.2+0x74/0x160 age=3 cpu=1 pid=799\n     __slab_alloc+0x768/0x970\n     kmem_cache_alloc+0x2e7/0x450\n     mpol_new.part.2+0x74/0x160\n     mpol_new+0x66/0x80\n     SyS_mbind+0x267/0x9f0\n     system_call_fastpath+0x16/0x1b\n  INFO: Freed in __mpol_put+0x2b/0x40 age=4 cpu=1 pid=799\n     __slab_free+0x495/0x8e0\n     kmem_cache_free+0x2f3/0x4c0\n     __mpol_put+0x2b/0x40\n     SyS_mbind+0x383/0x9f0\n     system_call_fastpath+0x16/0x1b\n  INFO: Slab 0xffffea0009cb8dc0 objects=23 used=8 fp=0xffff8801f582de40 flags=0x200000000004080\n  INFO: Object 0xffff8801f582d760 @offset=5984 fp=0xffff8801f582d600\n\n  Bytes b4 ffff8801f582d750: ae 01 ff ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  ........ZZZZZZZZ\n  Object ffff8801f582d760: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n  Object ffff8801f582d770: 6b 6b 6b 6b 6b 6b 6b a5                          kkkkkkk.\n  Redzone ffff8801f582d778: bb bb bb bb bb bb bb bb                          ........\n  Padding ffff8801f582d8b8: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ\n  Memory state around the buggy address:\n  ffff8801f582d600: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff8801f582d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  >ffff8801f582d700: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fc\n\n!shared memory policy is not protected against parallel removal by other\nthread which is normally protected by the mmap_sem.  do_get_mempolicy,\nhowever, drops the lock midway while we can still access it later.\n\nEarly premature up_read is a historical artifact from times when\nput_user was called in this path see https://lwn.net/Articles/124754/\nbut that is gone since 8bccd85ffbaf (\"[PATCH] Implement sys_* do_*\nlayering in the memory policy layer.\").  but when we have the the\ncurrent mempolicy ref count model.  The issue was introduced\naccordingly.\n\nFix the issue by removing the premature release.\n\nLink: http://lkml.kernel.org/r/1502950924-27521-1-git-send-email-zhongjiang@huawei.com\nSigned-off-by: zhong jiang <zhongjiang@huawei.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nCc: Minchan Kim <minchan@kernel.org>\nCc: Vlastimil Babka <vbabka@suse.cz>\nCc: David Rientjes <rientjes@google.com>\nCc: Mel Gorman <mgorman@techsingularity.net>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/d5a76b2ba6871a875fdcd598548176ce3464aa30"},{"sha":"ce76d8b8c727dea127099a7263f2ccd744b2aab0","author":{"name":"Boris Brezillon","email":"d3686c1eb756201cacdf5983212dc6c4a5a469fe@free-electrons.com"},"message":"irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup()\n\ncommit 469bcef53c546bb792aa66303933272991b7831d upstream.\n\naic_common_irq_fixup() is calling twice of_node_put() on the same node\nthus leading to an unbalanced refcount on the root node.\n\nSigned-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>\nReported-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>\nFixes: b2f579b58e93 (\"irqchip: atmel-aic: Add irq fixup infrastructure\")\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/ce76d8b8c727dea127099a7263f2ccd744b2aab0"},{"sha":"165f22abe9eff817d9771dd94a1dfbe6f335d459","author":{"name":"Boris Brezillon","email":"d3686c1eb756201cacdf5983212dc6c4a5a469fe@free-electrons.com"},"message":"irqchip/atmel-aic: Fix unbalanced refcount in aic_common_rtc_irq_fixup()\n\ncommit 277867ade8262583f4280cadbe90e0031a3706a7 upstream.\n\nof_find_compatible_node() is calling of_node_put() on its first argument\nthus leading to an unbalanced of_node_get/put() issue if the node has not\nbeen retained before that.\n\nInstead of passing the root node, pass NULL, which does exactly the same:\niterate over all DT nodes, starting from the root node.\n\nSigned-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>\nReported-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>\nFixes: 3d61467f9bab (\"irqchip: atmel-aic: Implement RTC irq fixup\")\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/165f22abe9eff817d9771dd94a1dfbe6f335d459"},{"sha":"8cf95002f0c9afe06fa1e4b9ebb0e10a77c481b1","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"Sanitize 'move_pages()' permission checks\n\ncommit 197e7e521384a23b9e585178f3f11c9fa08274b9 upstream.\n\nThe 'move_paghes()' system call was introduced long long ago with the\nsame permission checks as for sending a signal (except using\nCAP_SYS_NICE instead of CAP_SYS_KILL for the overriding capability).\n\nThat turns out to not be a great choice - while the system call really\nonly moves physical page allocations around (and you need other\ncapabilities to do a lot of it), you can check the return value to map\nout some the virtual address choices and defeat ASLR of a binary that\nstill shares your uid.\n\nSo change the access checks to the more common 'ptrace_may_access()'\nmodel instead.\n\nThis tightens the access checks for the uid, and also effectively\nchanges the CAP_SYS_NICE check to CAP_SYS_PTRACE, but it's unlikely that\nanybody really _uses_ this legacy system call any more (we hav ebetter\nNUMA placement models these days), so I expect nobody to notice.\n\nFamous last words.\n\nReported-by: Otto Ebeling <otto.ebeling@iki.fi>\nAcked-by: Eric W. Biederman <ebiederm@xmission.com>\nCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/8cf95002f0c9afe06fa1e4b9ebb0e10a77c481b1"},{"sha":"63407c4d1f9f64015974206e9bf40b318fdd74ee","author":{"name":"Oleg Nesterov","email":"66df68a59e3b21ba65b9e7f3fee04bb7abd7ddc2@redhat.com"},"message":"pids: make task_tgid_nr_ns() safe\n\ncommit dd1c1f2f2028a7b851f701fc6a8ebe39dcb95e7c upstream.\n\nThis was reported many times, and this was even mentioned in commit\n52ee2dfdd4f5 (\"pids: refactor vnr/nr_ns helpers to make them safe\") but\nsomehow nobody bothered to fix the obvious problem: task_tgid_nr_ns() is\nnot safe because task->group_leader points to nowhere after the exiting\ntask passes exit_notify(), rcu_read_lock() can not help.\n\nWe really need to change __unhash_process() to nullify group_leader,\nparent, and real_parent, but this needs some cleanups.  Until then we\ncan turn task_tgid_nr_ns() into another user of __task_pid_nr_ns() and\nfix the problem.\n\nReported-by: Troy Kensinger <tkensinger@google.com>\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/63407c4d1f9f64015974206e9bf40b318fdd74ee"},{"sha":"ae0ead2b17862e8d0fcf0755625bea5d942523fc","author":{"name":"Hector Martin","email":"003a4d79549d2811c83ec2080fcc1026ef6c363d@marcan.st"},"message":"usb: qmi_wwan: add D-Link DWM-222 device ID\n\ncommit bed9ff165960921303a100228585f2d1691b42eb upstream.\n\nSigned-off-by: Hector Martin <marcan@marcan.st>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/ae0ead2b17862e8d0fcf0755625bea5d942523fc"},{"sha":"25efe5c96eb6454d87127afb3affe3c874e1d45e","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Linux 3.18.67","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/25efe5c96eb6454d87127afb3affe3c874e1d45e"}]}
{"actor":{"display_login":"woodsts"}}